Terminology
Advisory, severity, applicability, and source terms used by Basilisk.
These terms appear in API responses and the explorer.
Results
| Term | Definition |
|---|---|
| Advisory | A published report of a software vulnerability. |
CVE ID, for example CVE-2023-50447 | An identifier assigned to a vulnerability. Different databases may use different IDs for the same issue; Basilisk groups the aliases it knows about. |
| Severity | The impact reported by the advisory source, usually scored from 0 to 10. It does not say whether the vulnerability affects a particular installation. |
| Clean | Basilisk covers the package version and found no matching advisories. This still depends on the coverage and freshness of the source data. |
| Not checked | Basilisk is missing the package, version, identity, or fresh source data needed to check it. This is an unknown result, not a clean one. |
| Malware | The package is reported as malicious rather than vulnerable. CVSS-style severity scores do not apply. |
Applicability and identity
| Term | Definition |
|---|---|
| Evaluated | The package version falls inside the affected range reported by the advisory. This is a version-range match, not proof that the vulnerability is exploitable in a particular installation. |
| Unevaluated | The advisory names the package, but Basilisk could not evaluate its version information. The match needs another look. |
| Version unbounded | The advisory identifies the package but has no usable version bounds. Basilisk cannot narrow the match to specific versions. |
| Automatic identity | The package-to-project mapping was created automatically and has not been manually verified. |
Sources
| Source | Definition |
|---|---|
| OSV | osv.dev, a vulnerability database and schema for open-source packages. Basilisk ingests selected OSV ecosystems. |
| NVD | The U.S. National Vulnerability Database at nvd.nist.gov. Basilisk uses its CVE metadata and CPE configurations. |
Reading a result
An evaluated match deserves attention, but it is still a match against a reported version range. Unevaluated and version unbounded matches need more review. Not checked means Basilisk does not have enough coverage to answer yet.
See How matching works for the exact range and comparator rules.